Hah, well, as you authored it you know what it says better than I! :) But I'm inclined to say that "they're at greater risk of implementation flaws because of

Hah, well, as you authored it you know what it says better than I! :) But I'm inclined to say that "they're at greater risk of implementation flaws because of their design" -- and unlike you, for me I believe that itself does actually count as a design flaw. (And on a side topic/rant since you mention the ELF loader: were I to have Google's resources, I would be far more paranoid than they about this whole thing. e.g.: the ELF loader doesn't need to be fantastically speedy; why not write it using tools/languages with stronger guarantees of memory safety? (That would hold for anything that wasn't inner-loop stuff, as well.) Another example: The verifier & safety of the allowed instructions are the crown jewels; why not hire the pointy-headed folks who do formal verification for some stronger assurances that the allowed instructions really are safe and that the verifier is complete?) Edit to add: And if changing the language & tooling isn't feasible, they could have at least pulled a neat trick and run the ELF loader (and similarly exposed code) within their own sandbox, rather than outside of it.